WEBVTT 00:00:00.840 --> 00:00:01.720 In this module, 00:00:01.750 --> 00:00:04.890 we're going to discover why you may want to become compliant with any 00:00:04.890 --> 00:00:07.860 of the PCI standards and who you can get to help. 00:00:08.640 --> 00:00:11.710 Imagine that you're going to be in charge of Wired Brain 00:00:11.710 --> 00:00:16.430 Coffee's compliance with PCI DSS. Well, in this module, 00:00:16.430 --> 00:00:19.760 we're going to find out who might be asking you to comply with the standard 00:00:20.340 --> 00:00:23.660 and also how to identify those people that can help you. 00:00:24.640 --> 00:00:26.860 When I first became a PCI assessor, 00:00:27.240 --> 00:00:31.280 I didn't pay attention to this part of the training because I didn't really 00:00:31.280 --> 00:00:34.440 understand the different roles of acquirers and card schemes, 00:00:34.670 --> 00:00:39.350 and actually, I didn't appreciate how important this was until I went 00:00:39.350 --> 00:00:44.050 to work for Visa Europe, but actually knowing who's making your 00:00:44.050 --> 00:00:46.990 organization comply with the PCI standard, 00:00:47.000 --> 00:00:52.320 especially the data security standard, is vitally important because it's 00:00:52.320 --> 00:00:55.800 that person you can talk to about any compliance problems you might 00:00:55.800 --> 00:01:01.600 have. As well as looking at why organizations comply, we're also going 00:01:01.600 --> 00:01:05.480 to find out about the programs and technical qualifications managed by 00:01:05.480 --> 00:01:09.790 the PCI SSC because you may well need to find someone to help you on 00:01:09.790 --> 00:01:14.060 your PCI journey, or perhaps you're thinking about becoming qualified 00:01:14.060 --> 00:01:14.660 yourself. 00:01:15.940 --> 00:01:21.600 It might surprise you to know that PCI compliance isn't generally a 00:01:21.600 --> 00:01:26.190 legal requirement, except in certain US states and a very small 00:01:26.190 --> 00:01:30.610 number of countries where compliance with PCI DSS has been 00:01:30.610 --> 00:01:34.160 incorporated international or state laws. 00:01:34.840 --> 00:01:38.650 If you're in one of those states or countries, you probably know about it. 00:01:39.240 --> 00:01:43.360 So I guess the question you are asking yourself is why do 00:01:43.360 --> 00:01:46.260 companies have to comply with PCI standards. 00:01:47.540 --> 00:01:51.290 Now, do you remember this slide from the first module? It showed how 00:01:51.290 --> 00:01:54.640 transactions went from the merchant to the acquirer through the card 00:01:54.640 --> 00:01:58.060 scheme and then to the issuer. As you might guess, 00:01:58.190 --> 00:02:01.660 there are contracts between all of the parties in this arrangement. 00:02:02.240 --> 00:02:07.550 Now I know I've just said the word contract, and remember, I said this was the 00:02:07.550 --> 00:02:10.600 bit of training that I zoned out over and I regret that. 00:02:10.650 --> 00:02:14.010 So stay with me for about 3 minutes because this is 00:02:14.010 --> 00:02:15.760 about to get really interesting. 00:02:16.640 --> 00:02:17.210 Firstly, 00:02:17.390 --> 00:02:20.670 there is a contract between the issuer and the scheme that lets the 00:02:20.670 --> 00:02:24.460 issuer give their cardholders cards within the scheme. 00:02:24.840 --> 00:02:28.860 That means if the contract is with Visa, they can issue cards with a Visa logo. 00:02:29.740 --> 00:02:32.910 There is a contract between the scheme and the acquiring banks 00:02:32.910 --> 00:02:36.610 that says the acquirer can sign up merchants and process their 00:02:36.610 --> 00:02:41.960 transactions and an acquiring bank is going to have contracts with 00:02:41.970 --> 00:02:43.830 each card scheme individually. 00:02:43.960 --> 00:02:48.850 So for example, it can acquire both Visa and Mastercard transactions. 00:02:49.740 --> 00:02:50.430 And finally, 00:02:50.580 --> 00:02:54.050 there is a contract between an acquirer and a merchant saying that the 00:02:54.050 --> 00:02:57.600 merchant will be able to accept all types of card transactions. 00:02:57.630 --> 00:03:00.480 And in all of these contracts, 00:03:00.660 --> 00:03:04.920 there are one or two requirements that are really interesting to us. 00:03:04.930 --> 00:03:09.560 Now seriously, in the contract between the issuer and the card scheme, 00:03:09.940 --> 00:03:13.380 the scheme will typically ask the issuer to comply with the data 00:03:13.380 --> 00:03:17.970 security standard and that it uses suppliers who are compliant with the 00:03:17.970 --> 00:03:19.460 card production standard. 00:03:20.040 --> 00:03:23.330 And if the issuer uses 3DS for ecom transaction 00:03:23.430 --> 00:03:26.230 authentication or it's a token provider, 00:03:26.470 --> 00:03:31.160 it will also be required in that contract to comply with the relevant standards. 00:03:32.340 --> 00:03:36.320 The contract between the card scheme and the acquirer is really 00:03:36.320 --> 00:03:39.000 important because it's split into two parts. 00:03:39.540 --> 00:03:44.290 The first part is similar to the scheme and issuer contract requiring the 00:03:44.290 --> 00:03:49.160 acquirer to comply with PCI DSS and also with PCI PIN. 00:03:50.440 --> 00:03:55.350 The second part is the one that will interest most people as it is this part 00:03:55.360 --> 00:04:00.260 of the contract that tells the acquirer that they are responsible for the way 00:04:00.260 --> 00:04:05.870 that they're merchants secure cardholder data and that the acquirer has to 00:04:05.870 --> 00:04:10.350 ensure that all of the merchants it allows to accept transactions from the 00:04:10.350 --> 00:04:13.660 card scheme comply with PCI DSS. 00:04:14.240 --> 00:04:18.899 So it's no surprise that the contract between the acquirer and the merchant 00:04:18.910 --> 00:04:22.250 specifies that the merchant must comply with PCI DSS. 00:04:22.640 --> 00:04:26.750 And so the reason that most companies have to comply with PCI DSS is 00:04:26.750 --> 00:04:29.790 because it's a condition of their acquiring contract. 00:04:29.800 --> 00:04:34.520 And so the enforcement of this comes from the acquirer, but what 00:04:34.520 --> 00:04:38.460 about three‑party schemes where there is no acquirer. 00:04:38.840 --> 00:04:41.000 Again, in the first module, 00:04:41.040 --> 00:04:44.750 we looked at the payment flows between the merchant and the scheme 00:04:44.810 --> 00:04:48.570 in a three‑party model like Amex or discover where there is no 00:04:48.570 --> 00:04:52.960 acquirer in the way. The transaction goes straight from the merchant 00:04:53.120 --> 00:04:55.050 to the scheme for authorization, 00:04:55.360 --> 00:04:58.870 as you probably guessed in the three‑party model just as the payment 00:04:58.870 --> 00:05:02.470 transaction goes directly to the scheme, the contract is between the 00:05:02.470 --> 00:05:06.430 scheme and the merchants and it is this scheme that makes the 00:05:06.430 --> 00:05:08.910 merchants comply with PCI DSS.